Privacy policy · Tableaf

The short version

Text PDF statements are read in your browser. The file and its transactions never reach our servers.
You don’t need an account to convert. If you create one, we keep your email address, your plan and billing status, your page counts and your sign-in sessions.
We use one cookie, and only for signed-in users. It is needed to keep you signed in. We use no tracking or advertising cookies.
We don’t sell or share your personal information.
You can ask us to delete your data at any time. We do it within 30 days.

Who we are

Tableaf is run by Dev Jhawar, a sole proprietorship in India. For the personal data described here, we are the controller (in India, the data fiduciary). Legal notices can be sent by email to [email protected]; a postal address is given on request.

Privacy questions and requests: [email protected].

What we collect

Data	Why	Where it lives
Email address	To sign you in with a one-time link, and to contact you about your account. Basis: contract.	Our database on Cloudflare (D1)
Plan and billing status, with the payment provider’s customer and subscription IDs	To give you the pages you paid for and link your account to your payments. Basis: contract.	Our database on Cloudflare (D1). Card details stay with the payment provider.
Page counts for each billing period	To apply plan limits. Basis: contract.	Our database on Cloudflare (D1)
Sign-in sessions: a hashed token, the time it was created and when it expires	To keep you signed in, and to sign you out after 30 days. Basis: contract and our interest in keeping accounts secure.	Our database on Cloudflare (D1)
Team membership (Firm plan)	To let the people you add share the plan’s pages. Basis: contract.	Our database on Cloudflare (D1)
Email address, plan and price region, if you ask to hear when paid plans open	To send that one email. Basis: your consent, which you can withdraw by emailing us. We delete it once we have written.	Our database on Cloudflare (D1)
Messages you send us	To answer you and fix problems. Basis: our legitimate interest in running the service, and your request.	Our email provider
Request details, such as your IP address	Your browser sends these with every request. Cloudflare uses them to deliver the site and protect it from abuse. Basis: our legitimate interest in a secure, working site.	Cloudflare

Payments are handled by our merchant of record, Dodo Payments. It collects your payment details and billing address, and keeps the invoices and tax records the law requires. We never see card numbers. Its own privacy policy covers what it does with that data.

What we don’t collect

For text PDFs, the server never receives statement contents, transactions or file names. Conversion happens entirely in your browser.

Two things are kept only in your browser’s local storage and are never sent to us: the free daily page count, and the fingerprints used to count each statement once. If you clear your browser’s site data, both are gone.

Scanned PDFs (planned)

Reading scanned PDFs (OCR) is not live yet. When it ships, it will run on a server through a third-party OCR provider. It will only happen after you click to agree, for each file. The file is deleted within 1 hour, and it is never used for training. The provider will be named on the subprocessors page before the feature goes live, and this policy will be updated at the same time.

A scanned statement contains financial data about you or your clients. Please read the consent prompt before you click.

Cookies and local storage

We set one cookie, and only when you are signed in. It is HttpOnly and strictly necessary: it keeps you signed in. Because we use nothing else, there is no cookie banner.

Your browser’s local storage holds preferences and counters. These stay on your device:

Your theme (light or dark).
Your export options.
Your price region.
The free daily page count and the statement fingerprints described above.

We don’t use tracking or advertising cookies, and we don’t load third-party scripts.

Analytics

We use Cloudflare Web Analytics to see which pages are visited and how fast they load. It is cookieless. We don’t send it anything from your statements, and we don’t use it to build profiles of individual visitors.

We use a few providers to run the service. They handle data on our behalf, under their own terms:

Cloudflare: hosting, content delivery, our database and analytics.
Resend: sends your sign-in emails.
Dodo Payments: payments, as merchant of record.
An OCR provider once scanned PDFs launch. To be named before OCR launches.

The subprocessors page has the purpose, data and location for each. We also share data if the law requires it, for example to answer a valid legal order. We don’t sell personal data, and we don’t share it for advertising.

Transfers abroad

We are in India, and our providers run services in several countries, so your data can be processed outside your own. Where the law requires safeguards for those transfers, such as standard contractual clauses under the GDPR and UK GDPR, we rely on the ones our providers offer. Ask us at [email protected] if you want details.

How long we keep it

Account data is kept while your account exists.
On request: we delete it within 30 days of your request, or of you deleting your account from the account page.
Sessions expire after 30 days.
“Tell me when paid plans open” emails are deleted once we have sent that email.
Billing records are kept by the merchant of record for as long as the law requires.
Scanned PDFs (once live) are deleted within 1 hour.

Your rights (GDPR and UK GDPR)

If you are in the European Economic Area or the United Kingdom, you can ask us to:

Tell you what personal data we hold about you, and give you a copy.
Correct data that is wrong.
Delete your data.
Restrict how we use it, or object to a use based on our legitimate interests.
Give you your data in a portable format.

Where we rely on your consent, you can withdraw it at any time. We don’t make decisions about you by automated means that have legal or similarly significant effects.

Email [email protected]. We may need to confirm it is you, and we reply within 30 days. You also have the right to complain to your data protection authority. In the UK that is the Information Commissioner’s Office.

India: DPDP Act 2023

Under India’s Digital Personal Data Protection Act, 2023, you can ask us for a summary of the personal data we process, ask us to correct or delete it, and nominate someone to exercise these rights for you if you die or become unable to. We process your data only for the purposes in the table above.

Grievance officer: Dev Jhawar, at [email protected]. We reply within 1 working day and aim to resolve grievances within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India once it is able to take complaints.

California

We don’t sell or share personal information, as those terms are defined in the California Consumer Privacy Act as amended by the CPRA. We don’t use or disclose sensitive personal information to infer characteristics about you. California residents can ask to know, correct or delete their data at [email protected], and we won’t treat you differently for asking.

Children

Tableaf is not for anyone under 18. We don’t knowingly collect data from children. If you think a child has given us their data, email us and we will delete it.

Security

The biggest protection is that text PDFs never reach us. For the data we do hold, we use HTTPS, hashed sign-in tokens and a strict Content Security Policy, and we keep what we store small. No system is perfectly secure. If a breach affects your data, we will tell you and the authorities as the law requires. More detail is on the security page.

Changes

If we change this policy, we will update the date at the top. If a change matters to how we treat your data, such as adding the OCR provider or a new subprocessor, we will say so on this page before it takes effect, and email account holders where the law requires it.

Contact and complaints

Privacy: [email protected]. General help: [email protected]. More ways to reach us are on the contact page.